EUROPE | Cyberattacks targeting supermarket refrigeration systems have spread across Europe, affecting stores in at least eight countries and extending into food processing and wholesale operations in the United Kingdom.
The latest incidents follow attacks on hundreds of French supermarkets in October, when hackers remotely altered refrigeration settings, forcing retailers to discard chilled and frozen food.
Among those affected in the latest attacks were 23 ICA stores and seven Coop stores in Sweden, 15 Carrefour stores in Belgium, and 13 SuperValu stores in Ireland. Incidents were also reported in Germany, Luxembourg, Estonia, and the Netherlands.
At one ICA store in Sweden, freezer temperatures were reportedly raised to 50°C, destroying stock.
The disruption has also reached food suppliers. The UK's Association of Independent Meat Suppliers confirmed that three members had experienced attacks involving Copeland XWEB refrigeration controllers. No meat was lost.
London-based organic produce wholesaler Langridge Organic reported that six of its 10 cold-room controllers had been compromised. Hackers remotely activated defrost cycles and disabled automated temperature alerts that would normally warn staff of unsafe storage conditions.
Managing director Alex Pearce told The Grocer that regular manual temperature checks helped staff identify the problem before stock was lost.
The incidents have exposed vulnerabilities in internet-connected refrigeration equipment, including older controllers and systems operating without current security updates.
Danfoss, whose equipment was among the systems affected, has advised customers to ensure controllers are not directly accessible from the internet and that supported systems have the latest security updates.
In Sweden, Coop has disconnected affected refrigeration systems from the internet while reviewing its wider network. ICA confirmed that equipment at its 23 affected stores was connected outside the supermarket group's centrally managed network.
The distinction is important for independently operated supermarkets, where refrigeration equipment and remote maintenance arrangements may differ between stores.
The UK's National Cyber Security Centre said it was working with affected organisations to identify and address vulnerabilities. It described the overall impact in Britain as minimal.
New Zealand's geographical isolation offers no protection against cyberattacks carried out remotely. An attacker operating anywhere in the world could potentially target vulnerable refrigeration systems here, just as they have in Europe. For retailers and suppliers, the issue is whether their connected equipment is adequately secured, regardless of where an attack originates.
Read more here.
